SB2025020450 - Multiple vulnerabilities in HPE AutoPass License Server (APLS)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025020450

SB2025020450 - Multiple vulnerabilities in HPE AutoPass License Server (APLS)

Published: February 4, 2025

Security Bulletin ID SB2025020450
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2024-51767)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests within the web service. A remote attacker can bypass authentication process and gain unauthorized access to the application.


2) Code Injection (CVE-ID: CVE-2024-51768)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to usage of vulnerable third party component within the hsqldb service. A remote user on the local network can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) SQL injection (CVE-ID: CVE-2024-51769)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the web service. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read data in database.


4) XML External Entity injection (CVE-ID: CVE-2024-51770)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the web service. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Remediation

Install update from vendor's website.

References